{"id":"CVE-2022-2024","published":"2023-02-25T00:00:00Z","modified":"2025-03-11T15:39:29Z","title":"OS Command Injection in gogs/gogs","vendor":"gogs","product":"gogs/gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs/gogs","versions":[">= unspecified, < 0.12.11"]}],"description":{"text":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw exists in the gogs/gogs product (the Gogs self-hosted Git service) in versions prior to 0.12.11, where special elements are not properly neutralised before being passed to an operating system command. An attacker can exploit it remotely over the network with no privileges or user interaction required, as the attack vector indicates network access with low complexity and no authentication or user action needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.97839,"percentile":0.99907,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97","tags":[]},{"url":"https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.11"],"patched":["0.12.11"],"from":["GHSA-pfvh-p8qp-9ww9","GO-2023-1596"],"provenance":"source"}],"advisories":[{"id":"GHSA-pfvh-p8qp-9ww9","url":"https://github.com/advisories/GHSA-pfvh-p8qp-9ww9","severity":"CRITICAL","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.11"],"patched":["0.12.11"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-0760","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0760","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-02-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-2024","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9991"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}